test: scope GKS-ONT-002 to pipeline facts and prove it end to end

[Freshair129]

Summary

This PR closes owner decision GKS-ONT-002 from the P1 report. No product code changes.

Decision: scope GKS-ONT-002 to GenesisRAG17 facts

The P1 report proposed applying the ontology endpoint table to legacy promote relations. That cannot be done as written:

• The endpoint table (PIPELINE_ONTOLOGY_ENDPOINTS) covers only the pipeline vocabulary: Person, Organization, Product, PACKAGE, PRICE_TIER and CATEGORY, with WORKS_FOR, PURCHASED, HAS_COMPONENT, PRICED_AT and IN_CATEGORY.
• Legacy API-010 relations use a different vocabulary: 16 entity types such as FEAT, API and ALGO, and 12 relation types such as DEPENDS_ON and IMPLEMENTS. That vocabulary has no ontology artifact version, and no endpoint table exists for it in this repository, the SRS, or spec 03.
• The SRS states the requirement as "fact acceptance SHALL validate subject type/predicate/object type against exact ontology artifact version", and spec 03 describes only the pipeline ontology baselines v1 and v2.
• The legacy payload is frozen (ADR-GKS-C0-QUALIFICATION D2). Rejecting combinations that were accepted before could break API-010 callers.

The owner chose to scope ONT-002 to GenesisRAG17 facts. ADR-GKS-GENESISRAG17 0.5.4b records this. A legacy endpoint table would need its own versioned decision.

Evidence for AT-GKS-ONT-002 ("invalid endpoint held/rejected and cannot materialize verified edge")

Until now, the pipeline's endpoint behaviour was covered only by buildPipelineDecision unit tests (pipeline-ontology-v2.test.mjs). This PR shows the same behaviour through the real service, using one valid fact (Alice works for Acme Ltd.) and one invalid-endpoint fact ({"subject":"Carol","predicate":"works_for","object":"Atlas"}, where Atlas is a Product):

Where	Result
decision.held	[{ reason: "invalid_endpoint", predicate: "works_for", … }]
decision.facts, decision.graph.edges	only Alice's WORKS_FOR; no fact or edge touches Carol
gate	verdict: "WARN", allowPublication: false, knowledge reason 1 fact(s) remain held for review.
publication receipt	gks_conflict: pipeline execution does not allow publication.

• Contract test: tests/contract/pipeline-genesisrag17.test.mjs.
• Golden corpus: C0.4-GENESISRAG17-RECEIPTS gains a third batch with the same steps, including a second (non-destructive) claim that shows the held fact. Each step's expected result and message are annotated. That case is the only transcript that changes.

Test plan

• New contract test (above)
• npm test: vitest 299 passed and 2 skipped (the MSP suites need MSP_REPO_ROOT); security 12/12
• npm run check:c0 (PASS 24 / NOT_RUN 1), check:baseline and check:corpus pass
• CI on this PR

🤖 Generated with Claude Code